diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index c738754..bb7a455 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -25,35 +25,55 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v4 - with: - token: ${{ secrets.CI_BOT_TOKEN }} + with: + token: ${{ secrets.CI_BOT_TOKEN }} + + - name: Install jq (for parsing JSON) + run: sudo apt-get update && sudo apt-get install -y jq - name: Set up Python uses: actions/setup-python@v4 - with: + with: python-version: ${{ env.PYTHON_VERSION }} - name: Install dependencies run: | python -m pip install --upgrade pip --root-user-action=ignore - pip install --root-user-action=ignore safety bandit semgrep + # Pin safety to a v2 line where `check --json` is stable + pip install --root-user-action=ignore "safety>=2,<3" bandit semgrep - name: Run Safety check run: | - safety check -r requirements.txt --json --output safety-report.json || true - safety check -r requirements-dev.txt --json --output safety-dev-report.json || true + if [ -f requirements.txt ]; then + safety check -r requirements.txt --json --output safety-report.json || true + else + echo "[]" > safety-report.json + fi + if [ -f requirements-dev.txt ]; then + safety check -r requirements-dev.txt --json --output safety-dev-report.json || true + else + echo "[]" > safety-dev-report.json + fi - name: Run Bandit security scan run: | - bandit -r src/ -f json -o bandit-report.json || true + if [ -d src ]; then + bandit -r src/ -f json -o bandit-report.json || true + else + echo '{"results":[]}' > bandit-report.json + fi - name: Run Semgrep security scan run: | - semgrep --config=auto src/ --json --output=semgrep-report.json || true + if [ -d src ]; then + semgrep --config=auto src/ --json --output=semgrep-report.json || true + else + echo '{"results":[]}' > semgrep-report.json + fi - name: Upload security reports uses: actions/upload-artifact@v3 - with: + with: name: security-reports-${{ github.run_number }} path: | safety-report.json @@ -65,28 +85,43 @@ jobs: run: | echo "๐Ÿ” Checking for critical vulnerabilities..." - # Check Safety results - if [ -f safety-report.json ]; then - critical_count=$(jq '.vulnerabilities | length' safety-report.json 2>/dev/null || echo "0") - if [ "$critical_count" -gt 0 ]; then - echo "โš ๏ธ Found $critical_count dependency vulnerabilities" - jq '.vulnerabilities[] | "- \(.package_name) \(.installed_version): \(.vulnerability_id)"' safety-report.json - else - echo "โœ… No dependency vulnerabilities found" - fi - fi + # --- Safety results (robust to array/object formats) --- + summarize_safety () { + f="$1" + if [ -f "$f" ]; then + count=$(jq -r ' + if type=="array" then length + else ((.vulnerabilities // []) | length) + end + ' "$f" 2>/dev/null || echo "0") - # Check Bandit results + if [ "${count:-0}" -gt 0 ]; then + echo "โš ๏ธ Found $count dependency vulnerabilities in $f" + jq -r ' + if type=="array" then + .[] | "- \(.package_name // .name) \(.installed_version // ""): \(.vulnerability_id // .advisory // "N/A")" + else + (.vulnerabilities // [])[] | "- \(.package_name) \(.installed_version): \(.vulnerability_id)" + end + ' "$f" || true + else + echo "โœ… No dependency vulnerabilities found in $f" + fi + fi + } + summarize_safety safety-report.json + summarize_safety safety-dev-report.json + + # --- Bandit results (count HIGH severity properly) --- if [ -f bandit-report.json ]; then - high_severity=$(jq '.results[] | select(.issue_severity == "HIGH") | length' bandit-report.json 2>/dev/null | wc -l) - if [ "$high_severity" -gt 0 ]; then + high_severity=$(jq '[.results[]? | select(.issue_severity=="HIGH")] | length' bandit-report.json 2>/dev/null || echo "0") + if [ "${high_severity:-0}" -gt 0 ]; then echo "โš ๏ธ Found $high_severity high-severity security issues" else echo "โœ… No high-severity security issues found" fi fi - # License compliance check license-check: name: License Compliance @@ -95,19 +130,24 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v4 - with: - token: ${{ secrets.CI_BOT_TOKEN }} + with: + token: ${{ secrets.CI_BOT_TOKEN }} + + - name: Install jq (for parsing JSON) + run: sudo apt-get update && sudo apt-get install -y jq - name: Set up Python uses: actions/setup-python@v4 - with: + with: python-version: ${{ env.PYTHON_VERSION }} - name: Install pip-licenses run: | python -m pip install --upgrade pip --root-user-action=ignore pip install --root-user-action=ignore pip-licenses - pip install --root-user-action=ignore -r requirements.txt + if [ -f requirements.txt ]; then + pip install --root-user-action=ignore -r requirements.txt + fi - name: Check licenses run: | @@ -115,11 +155,10 @@ jobs: pip-licenses --format=json --output-file=licenses.json pip-licenses --format=markdown --output-file=licenses.md - # Check for problematic licenses + # Check for potentially problematic licenses problematic_licenses=("GPL" "AGPL" "LGPL") - for license in "${problematic_licenses[@]}"; do - if grep -i "$license" licenses.json; then + if grep -iq "$license" licenses.json; then echo "โš ๏ธ Found potentially problematic license: $license" fi done @@ -128,7 +167,7 @@ jobs: - name: Upload license report uses: actions/upload-artifact@v3 - with: + with: name: license-report-${{ github.run_number }} path: | licenses.json @@ -142,28 +181,29 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v4 - with: - token: ${{ secrets.CI_BOT_TOKEN }} + with: + token: ${{ secrets.CI_BOT_TOKEN }} + + - name: Install jq (for parsing JSON) + run: sudo apt-get update && sudo apt-get install -y jq - name: Set up Python uses: actions/setup-python@v4 - with: + with: python-version: ${{ env.PYTHON_VERSION }} - - name: Install pip-check-updates equivalent - run: | - python -m pip install --upgrade pip --root-user-action=ignore - pip install --root-user-action=ignore pip-review - - name: Check for outdated packages run: | echo "๐Ÿ“ฆ Checking for outdated packages..." - pip install --root-user-action=ignore -r requirements.txt + if [ -f requirements.txt ]; then + python -m pip install --upgrade pip --root-user-action=ignore + pip install --root-user-action=ignore -r requirements.txt + fi pip list --outdated --format=json > outdated-packages.json || true - if [ -s outdated-packages.json ]; then + if [ -s outdated-packages.json ] && [ "$(cat outdated-packages.json)" != "[]" ]; then echo "๐Ÿ“‹ Outdated packages found:" - cat outdated-packages.json | jq -r '.[] | "- \(.name): \(.version) -> \(.latest_version)"' + jq -r '.[] | "- \(.name): \(.version) -> \(.latest_version)"' outdated-packages.json else echo "โœ… All packages are up to date" fi @@ -173,164 +213,9 @@ jobs: run: | if [ -s outdated-packages.json ] && [ "$(cat outdated-packages.json)" != "[]" ]; then echo "๐Ÿ“ Creating dependency update issue..." - - # Create issue body cat > issue-body.md << 'EOF' - ## ๐Ÿ“ฆ Dependency Updates Available +## ๐Ÿ“ฆ Dependency Updates Available - The following packages have updates available: - - EOF - - cat outdated-packages.json | jq -r '.[] | "- **\(.name)**: \(.version) โ†’ \(.latest_version)"' >> issue-body.md - - cat >> issue-body.md << 'EOF' - - ## ๐Ÿ” Security Impact - - Please review each update for: - - Security fixes - - Breaking changes - - Compatibility issues - - ## โœ… Action Items - - - [ ] Review changelog for each package - - [ ] Test updates in development environment - - [ ] Update requirements.txt - - [ ] Run full test suite - - [ ] Deploy to staging for validation - - --- - *This issue was automatically created by the security workflow.* - EOF - - echo "Issue body created. In a real implementation, you would create a Gitea issue here." - cat issue-body.md - fi - - - name: Upload dependency reports - uses: actions/upload-artifact@v3 - with: - name: dependency-reports-${{ github.run_number }} - path: | - outdated-packages.json - issue-body.md - - # Code quality metrics - code-quality: - name: Code Quality Metrics - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - token: ${{ secrets.CI_BOT_TOKEN }} - - - name: Set up Python - uses: actions/setup-python@v4 - with: - python-version: ${{ env.PYTHON_VERSION }} - - - name: Install quality tools - run: | - python -m pip install --upgrade pip --root-user-action=ignore - pip install --root-user-action=ignore radon xenon vulture - pip install --root-user-action=ignore -r requirements.txt - - - name: Calculate code complexity - run: | - echo "๐Ÿ“Š Calculating code complexity..." - radon cc src/ --json > complexity-report.json - radon mi src/ --json > maintainability-report.json - - echo "๐Ÿ” Complexity Summary:" - radon cc src/ --average - - echo "๐Ÿ”ง Maintainability Summary:" - radon mi src/ - - - name: Find dead code - run: | - echo "๐Ÿงน Checking for dead code..." - vulture src/ --json > dead-code-report.json || true - - - name: Check for code smells - run: | - echo "๐Ÿ‘ƒ Checking for code smells..." - xenon --max-absolute B --max-modules A --max-average A src/ || true - - - name: Upload quality reports - uses: actions/upload-artifact@v3 - with: - name: code-quality-reports-${{ github.run_number }} - path: | - complexity-report.json - maintainability-report.json - dead-code-report.json - - # Security summary - security-summary: - name: Security Summary - runs-on: ubuntu-latest - needs: [dependency-scan, docker-security-scan, license-check, code-quality] - if: always() - - steps: - - name: Download all artifacts - uses: actions/download-artifact@v3 - - - name: Generate security summary - run: | - echo "# ๐Ÿ”’ Security Scan Summary" > security-summary.md - echo "" >> security-summary.md - echo "**Scan Date:** $(date -u)" >> security-summary.md - echo "**Repository:** ${{ github.repository }}" >> security-summary.md - echo "**Commit:** ${{ github.sha }}" >> security-summary.md - echo "" >> security-summary.md - - echo "## ๐Ÿ“Š Results" >> security-summary.md - echo "" >> security-summary.md - - # Dependency scan results - if [ -f security-reports-*/safety-report.json ]; then - vuln_count=$(jq '.vulnerabilities | length' security-reports-*/safety-report.json 2>/dev/null || echo "0") - if [ "$vuln_count" -eq 0 ]; then - echo "- โœ… **Dependency Scan**: No vulnerabilities found" >> security-summary.md - else - echo "- โš ๏ธ **Dependency Scan**: $vuln_count vulnerabilities found" >> security-summary.md - fi - else - echo "- โ“ **Dependency Scan**: Results not available" >> security-summary.md - fi - - # Docker scan results (removed Trivy) - echo "- โญ๏ธ **Docker Scan**: Skipped (Trivy removed)" >> security-summary.md - - # License check results - if [ -f license-report-*/licenses.json ]; then - echo "- โœ… **License Check**: Completed" >> security-summary.md - else - echo "- โ“ **License Check**: Results not available" >> security-summary.md - fi - - # Code quality results - if [ -f code-quality-reports-*/complexity-report.json ]; then - echo "- โœ… **Code Quality**: Analyzed" >> security-summary.md - else - echo "- โ“ **Code Quality**: Results not available" >> security-summary.md - fi - - echo "" >> security-summary.md - echo "## ๐Ÿ”— Detailed Reports" >> security-summary.md - echo "" >> security-summary.md - echo "Detailed reports are available in the workflow artifacts." >> security-summary.md - - cat security-summary.md - - - name: Upload security summary - uses: actions/upload-artifact@v3 - with: - name: security-summary-${{ github.run_number }} - path: security-summary.md +The following packages have updates available: +EOF + jq -r '.[] | "- **\(.name)**: \(.version) โ†’